java - How to use expression-based access control in spring? -


i new spring.i have created api user login.the user login method contains following codes:

authentication auth =new usernamepasswordauthenticationtoken(repo.findbyemail(user.getemail()), null, repo.findbyemail(user.getemail()).getauthorities());  securitycontextholder.getcontext().setauthentication(auth); principal principal= securitycontextholder.getcontext().getauthentication(); return (user) auth.getprincipal();

the login api gives me following json:

{ "userid": 1, "username": "ramesh khadka", "email": "test@gmail.com", "enabled": true, "role": "manager", "username": "ramesh khadka", "authorities": [     {         "authority": "role_manager"     } ], "accountnonexpired": true, "accountnonlocked": true, "credentialsnonexpired": true }

i have api users uses @preauthorize("hasauthority('role_manager')") check authorities granted.when call api following message shown:-

{ "error": "unauthorized", "error_description": "full authentication required access resource" }

i cannot figure out doing wrong.could me on this?

my authorizationserver is:-

@configuration @enableauthorizationserver public class securityserver extends authorizationserverconfigureradapter { @autowired @qualifier("userdetailsservice") private userdetailsservice userdetailsservice;  @autowired private authenticationmanager authenticationmanager;  @override public void configure(authorizationserversecurityconfigurer security) throws exception {     security.checktokenaccess("isauthenticated()"); }  @override public void configure(clientdetailsserviceconfigurer clients) throws exception {     // super.configure(clients);     clients.inmemory()             .withclient("test")             .accesstokenvalidityseconds(3600)             .authorizedgranttypes("authorization_code","refresh_token","password","client_credentials")             .secret("user")             .scopes("read", "write", "trust")             .redirecturis("/error")             .resourceids("resource"); }  @override public void configure(authorizationserverendpointsconfigurer endpoints) throws exception {     endpoints.authenticationmanager(this.authenticationmanager);     endpoints.userdetailsservice(userdetailsservice); } @bean public passwordencoder passwordencoder() {     return new bcryptpasswordencoder(); } @bean public filterregistrationbean corsfilter() {     urlbasedcorsconfigurationsource source = new urlbasedcorsconfigurationsource();     corsconfiguration config = new corsconfiguration();     config.setallowcredentials(true);     config.addallowedorigin("*");     config.addallowedheader("*");     config.addallowedmethod("*");     source.registercorsconfiguration("/**", config);     filterregistrationbean bean = new filterregistrationbean(new corsfilter(source));     bean.setorder(ordered.highest_precedence);     return bean; }

}

as described in code have use '@preauthorize("hasauthority('role_manager')")'

hasauthority([authority]) --> returns true if current principal has specified authority.

please add '@preauthorize("hasrole('manager')") `

@preauthorize("hasrole('user')") public void create(contact contact);

either may use role looking , check hasanyrole([role1,role2]) --> returns true if current principal has of supplied roles (given comma-separated list of strings). default if supplied role not start 'role_' added. can customized modifying defaultroleprefix on defaultwebsecurityexpressionhandler.

for more may refer these links: https://docs.spring.io/spring-security/site/docs/3.0.x/reference/el-access.html https://dzone.com/refcardz/expression-based-authorization


Comments

Post a Comment

Popular posts from this blog

php - Vagrant up error - Uncaught Reflection Exception: Class DOMDocument does not exist -

i've set bento/ubuntu-16.04 vagrant box using php 5.6, , getting following error quite few times when try , run shell script: "uncaught reflection exception: class domdocument not exist". i've tried adding following top of script (not together), each no success: "sudo apt-get install php5.6-xml", "sudo apt-get install php5-xml", "sudo apt-get install php-dom" i've tried resetting server "sudo service apache2 restart". does have suggestions?
Read more

vue.js - Create hooks for automated testing -

Image
qa guys complained can't automate frontend testing. because our html looks same outside. lazy hack did this <template> <div :role="$options.name"> ... </div> </template> <script> export default { name: 'vmcomponentname' } </script> which takes name script , applies html. in browser get: <div role="vmcomponentname"> ... </div> line :role="$options.name" goes in every component. is there dry er solutions? please share. additional details i'll explain in details looking for. imagine have vmusercreate form creates user. test case can create user . to automatically test without role, have use following selector: .wrapper > .wrapper > .wrapper > .submit-button the test extremely brittle (will break lot). if use roles can use [role="vmusercreateform"] .submit-button selector. many folds less brittle. so basically, i'm ...
Read more

Add new key value to json node in java -

i have json file : { "id":1, "name":"abc", "addressdetails": { "city":"newyork" } } i wanted add 1 more key-value ("pincode" : "414141") node 'addressdetails'. i tried using : objectmapper mapper = new objectmapper(); jsonnode root = mapper.readtree(new file("d://test.json")); objectnode node = mapper.createobjectnode(); node.with("addressdetails").put("pincode", "414141"); but it's not getting added, there way can ? you can try you should modify file path objectmapper mapper = new objectmapper(); objectnode nodes = mapper.readvalue(new file("d:\\test.txt"), objectnode.class); nodes.with("addressdetails").put("pincode", "414141"); mapper.writer().writevalue(new file("d:\\test.txt"), nodes);
Read more